Commit graph

1,447,411 commits

Author SHA1 Message Date
Can Guo
6669ab18c2 scsi: ufs: core: Add UFS_HS_G6 and UFS_HS_GEAR_MAX to enum ufs_hs_gear_tag
Add UFS_HS_G6 to enum ufs_hs_gear_tag. In addition, add UFS_HS_GEAR_MAX to
enum ufs_hs_gear_tag to facilitate iteration over valid High Speed Gears.

Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260325152154.1604082-4-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:20:29 -04:00
Can Guo
c91c836716 scsi: ufs: core: Pass force_pmc to ufshcd_config_pwr_mode() as a parameter
Currently, callers must manually toggle hba->force_pmc before and after
calling ufshcd_config_pwr_mode() to force a Power Mode change. Introduce
enum ufshcd_pmc_policy and refactor ufshcd_config_pwr_mode() to accept
pmc_policy as a parameter to force a Power Mode change.

Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260325152154.1604082-3-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:20:29 -04:00
Can Guo
d3eba21c71 scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode()
Most vendor specific implemenations of vops pwr_change_notify(PRE_CHANGE)
are fulfilling two things at once:

 - Vendor specific target power mode negotiation

 - Vendor specific power mode change preparation

When TX Equalization is added into consideration, before power mode change
to a target power mode, TX Equalization Training (EQTR) needs be done for
that target power mode. In addition, UFSHCI spec requires to start TX EQTR
from HS-G1 (the most reliable High Speed Gear).

Adding TX EQTR before pwr_change_notify(PRE_CHANGE) is not applicable
because we don't know the negotiated power mode yet.

Adding TX EQTR post pwr_change_notify(PRE_CHANGE) is inappropriate because
pwr_change_notify(PRE_CHANGE) has finished preparation for a power mode
change to negotiated power mode, yet we are changing power mode to HS-G1
for TX EQTR.

Add a new vops negotiate_pwr_mode() so that vendor specific power mode
negotiation can be fulfilled in its vendor specific implementations.  Later
on, TX EQTR can be added post vops negotiate_pwr_mode() and before vops
pwr_change_notify(PRE_CHANGE).

Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260325152154.1604082-2-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:20:29 -04:00
Keith Busch
33eded2931 dm: provide helper to set stacked limits
There are multiple device mappers that set up their stacking limits
exactly the same for the logical, physical and minimum IO queue limits.
Provide a helper for it.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-27 22:19:17 +01:00
Keith Busch
cbc1532d2b dm-integrity: always set the io hints
Don't depend on the defaults to be what is desired if the integrity
device was set up with 512b sector size. Always set the queue limits to
be at least what the device mapper wants.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-27 22:19:08 +01:00
Keith Busch
6ebf3b6c6f dm-integrity: fix mismatched queue limits
A user can integritysetup a device with a backing device using a 4k
logical block size, but request the dm device use 1k or 2k. This
mismatch creates an inconsistency such that the dm device would report
limits for IO that it can't actually execute. Fix this by using the
backing device's limits if they are larger.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-27 22:18:56 +01:00
Zilin Guan
d47059dcc4 hfsplus: extract hidden directory search into a helper function
In hfsplus_fill_super(), the process of looking up the hidden directory
involves initializing a catalog search, building a search key, reading
the b-tree record, and releasing the search data.

Currently, this logic is open-coded directly within the main superblock
initialization routine. This makes hfsplus_fill_super() quite lengthy
and its error handling paths less straightforward.

Extract the hidden directory search sequence into a new helper function,
hfsplus_get_hidden_dir_entry(). This improves overall code readability,
cleanly encapsulates the hfs_find_data lifecycle, and simplifies the
error exits in hfsplus_fill_super().

Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-03-27 14:17:50 -07:00
Zilin Guan
90c500e4fd hfsplus: fix held lock freed on hfsplus_fill_super()
hfsplus_fill_super() calls hfs_find_init() to initialize a search
structure, which acquires tree->tree_lock. If the subsequent call to
hfsplus_cat_build_key() fails, the function jumps to the out_put_root
error label without releasing the lock. The later cleanup path then
frees the tree data structure with the lock still held, triggering a
held lock freed warning.

Fix this by adding the missing hfs_find_exit(&fd) call before jumping
to the out_put_root error label. This ensures that tree->tree_lock is
properly released on the error path.

The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is specifically
designed to detect memory management issues. It is currently under active
development and not yet publicly available.

We confirmed the bug by runtime testing under QEMU with x86_64 defconfig,
lockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we
used GDB to dynamically shrink the max_unistr_len parameter to 1 before
hfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally
return -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and
exercises the faulty error path. The following warning was observed
during mount:

	=========================
	WARNING: held lock freed!
	7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted
	-------------------------
	mount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there!
	ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0
	2 locks held by mount/174:
	#0: ffff888103f960e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40
	#1: ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0

	stack backtrace:
	CPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy)
	Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
	Call Trace:
	<TASK>
	dump_stack_lvl+0x82/0xd0
	debug_check_no_locks_freed+0x13a/0x180
	kfree+0x16b/0x510
	? hfsplus_fill_super+0xcb4/0x18a0
	hfsplus_fill_super+0xcb4/0x18a0
	? __pfx_hfsplus_fill_super+0x10/0x10
	? srso_return_thunk+0x5/0x5f
	? bdev_open+0x65f/0xc30
	? srso_return_thunk+0x5/0x5f
	? pointer+0x4ce/0xbf0
	? trace_contention_end+0x11c/0x150
	? __pfx_pointer+0x10/0x10
	? srso_return_thunk+0x5/0x5f
	? bdev_open+0x79b/0xc30
	? srso_return_thunk+0x5/0x5f
	? srso_return_thunk+0x5/0x5f
	? vsnprintf+0x6da/0x1270
	? srso_return_thunk+0x5/0x5f
	? __mutex_unlock_slowpath+0x157/0x740
	? __pfx_vsnprintf+0x10/0x10
	? srso_return_thunk+0x5/0x5f
	? srso_return_thunk+0x5/0x5f
	? mark_held_locks+0x49/0x80
	? srso_return_thunk+0x5/0x5f
	? srso_return_thunk+0x5/0x5f
	? irqentry_exit+0x17b/0x5e0
	? trace_irq_disable.constprop.0+0x116/0x150
	? __pfx_hfsplus_fill_super+0x10/0x10
	? __pfx_hfsplus_fill_super+0x10/0x10
	get_tree_bdev_flags+0x302/0x580
	? __pfx_get_tree_bdev_flags+0x10/0x10
	? vfs_parse_fs_qstr+0x129/0x1a0
	? __pfx_vfs_parse_fs_qstr+0x3/0x10
	vfs_get_tree+0x89/0x320
	fc_mount+0x10/0x1d0
	path_mount+0x5c5/0x21c0
	? __pfx_path_mount+0x10/0x10
	? trace_irq_enable.constprop.0+0x116/0x150
	? trace_irq_enable.constprop.0+0x116/0x150
	? srso_return_thunk+0x5/0x5f
	? srso_return_thunk+0x5/0x5f
	? kmem_cache_free+0x307/0x540
	? user_path_at+0x51/0x60
	? __x64_sys_mount+0x212/0x280
	? srso_return_thunk+0x5/0x5f
	__x64_sys_mount+0x212/0x280
	? __pfx___x64_sys_mount+0x10/0x10
	? srso_return_thunk+0x5/0x5f
	? trace_irq_enable.constprop.0+0x116/0x150
	? srso_return_thunk+0x5/0x5f
	do_syscall_64+0x111/0x680
	entry_SYSCALL_64_after_hwframe+0x77/0x7f
	RIP: 0033:0x7ffacad55eae
	Code: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8
	RSP: 002b:00007fff1ab55718 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
	RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffacad55eae
	RDX: 000055740c64e5b0 RSI: 000055740c64e630 RDI: 000055740c651ab0
	RBP: 000055740c64e380 R08: 0000000000000000 R09: 0000000000000001
	R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
	R13: 000055740c64e5b0 R14: 000055740c651ab0 R15: 000055740c64e380
	</TASK>

After applying this patch, the warning no longer appears.

Fixes: 89ac9b4d3d ("hfsplus: fix longname handling")
CC: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-03-27 14:17:44 -07:00
Martin K. Petersen
1801c8284d Merge patch series "mpi3mr: Enhancements for mpi3mr"
Ranjan Kumar <ranjan.kumar@broadcom.com> says:

Enhancements for mpi3mr driver

Link: https://patch.msgid.link/20260320090326.47544-1-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:10:03 -04:00
Ranjan Kumar
02ff1d2bcf scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset
Enhance the IOC shutdown process to handle transient failures during
controller cleanup. Add retry logic with configurable maximum retry
count (MPI3MR_MAX_SHUTDOWN_RETRY_COUNT) and proper timeout management
that resets on each retry attempt. This ensures shutdown can recover
from temporary issues without failing completely.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://patch.msgid.link/20260320090326.47544-4-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:09:01 -04:00
Ranjan Kumar
9d660e4820 scsi: mpi3mr: Add queue-full tracking for operational request queues
Track queue-full conditions on operational request queues in the driver.
Record the last host tag returned to the SCSI mid-layer and count I/Os
affected by queue-full conditions.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://patch.msgid.link/20260320090326.47544-3-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:09:01 -04:00
Ranjan Kumar
31693fbbfa scsi: mpi3mr: Reset controller on invalid I/O completion
Operational replies without a valid scsi_cmnd indicate an invalid I/O
completion and a potentially inconsistent controller state.  Track this
condition and allow the watchdog to trigger a soft reset to safely
recover.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://patch.msgid.link/20260320090326.47544-2-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 17:07:35 -04:00
Qinxin Xia
74e2dbe7be perf tools: Add --pmu-filter option for filtering PMUs
This patch adds a new --pmu-filter option to perf-stat command to allow
filtering events on specific PMUs. This is useful when there are
multiple PMUs with same type (e.g. hisi_sicl2_cpa0 and hisi_sicl0_cpa0).

[root@localhost tmp]# perf stat -M cpa_p0_avg_bw
 Performance counter stats for 'system wide':

    19,417,779,115      hisi_sicl0_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                 0      hisi_sicl0_cpa0/cpa_p0_wr_dat/
                 0      hisi_sicl0_cpa0/cpa_p0_rd_dat_64b/
                 0      hisi_sicl0_cpa0/cpa_p0_rd_dat_32b/
    19,417,751,103      hisi_sicl10_cpa0/cpa_cycles/     #     0.00 cpa_p0_avg_bw
                 0      hisi_sicl10_cpa0/cpa_p0_wr_dat/
                 0      hisi_sicl10_cpa0/cpa_p0_rd_dat_64b/
                 0      hisi_sicl10_cpa0/cpa_p0_rd_dat_32b/
    19,417,730,679      hisi_sicl2_cpa0/cpa_cycles/      #     0.31 cpa_p0_avg_bw
        75,635,749      hisi_sicl2_cpa0/cpa_p0_wr_dat/
        18,520,640      hisi_sicl2_cpa0/cpa_p0_rd_dat_64b/
                 0      hisi_sicl2_cpa0/cpa_p0_rd_dat_32b/
    19,417,674,227      hisi_sicl8_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                 0      hisi_sicl8_cpa0/cpa_p0_wr_dat/
                 0      hisi_sicl8_cpa0/cpa_p0_rd_dat_64b/
                 0      hisi_sicl8_cpa0/cpa_p0_rd_dat_32b/

      19.417734480 seconds time elapsed

[root@localhost tmp]# perf stat --pmu-filter hisi_sicl2_cpa0 -M cpa_p0_avg_bw
 Performance counter stats for 'system wide':

     6,234,093,559      cpa_cycles                       #     0.60 cpa_p0_avg_bw
        50,548,465      cpa_p0_wr_dat
         7,552,182      cpa_p0_rd_dat_64b
                 0      cpa_p0_rd_dat_32b

       6.234139320 seconds time elapsed

Signed-off-by: Qinxin Xia <xiaqinxin@huawei.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-27 13:58:01 -07:00
Kexin Sun
5b44c3757c scsi: iscsi_tcp: update outdated comment for renamed iscsi_conn_set_callbacks()
The function iscsi_conn_set_callbacks() was renamed to
iscsi_sw_tcp_conn_set_callbacks() by commit 38e1a8f547 ("[SCSI]
iscsi_tcp: hook iscsi_tcp into new libiscsi_tcp module").  Update the
stale reference in iscsi_sw_tcp_conn_restore_callbacks().

Assisted-by: unnamed:deepseek-v3.2 coccinelle
Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn>
Link: https://patch.msgid.link/20260321105904.7726-1-kexinsun@smail.nju.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:51:15 -04:00
Kexin Sun
3d1a36afa4 scsi: lpfc: Update outdated comment for renamed lpfc_freenode()
The function lpfc_freenode() was renamed to lpfc_cleanup_node() by
commit 685f0bf7af ("[SCSI] lpfc 8.1.12 : Collapse discovery lists to a
single node list"), and commit a70e63eee1 ("scsi: lpfc: Fix NPIV
Fabric Node reference counting") later removed the lpfc_unreg_rpi() call
from lpfc_cleanup_node().

Remove the now-inaccurate "called from lpfc_freenode()" sentence and
reflow the remaining comment text for lpfc_unreg_rpi().

Assisted-by: unnamed:deepseek-v3.2 coccinelle
Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn>
Link: https://patch.msgid.link/20260321105909.7804-1-kexinsun@smail.nju.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:49:04 -04:00
Danilo Krummrich
15a4bb87ab gpu: nova-core: use sized array for GSP log buffers
Switch LogBuffer from Coherent<[u8]> (unsized) to
Coherent<[u8; LOG_BUFFER_SIZE]> (sized). The buffer size is a
compile-time constant (RM_LOG_BUFFER_NUM_PAGES * GSP_PAGE_SIZE), so a
fixed-size array is more precise and avoids the need for the runtime
length parameter of zeroed_slice().

Acked-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260325003921.3420-3-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 21:48:23 +01:00
Danilo Krummrich
d1619a4338 rust: dma: generalize BinaryWriter impl for Coherent<T>
Generalize the BinaryWriter implementation from Coherent<[u8]> to
Coherent<T> where T: KnownSize + AsBytes + ?Sized. The implementation
only uses size() and write_dma(), neither of which depends on the
inner type being a byte slice.

This allows any Coherent allocation with an AsBytes inner type to be
exposed as a debugfs binary file.

Acked-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260325003921.3420-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 21:48:18 +01:00
Danilo Krummrich
25fe63db00 rust: uaccess: generalize write_dma() to accept any Coherent<T>
Generalize write_dma() from &Coherent<[u8]> to &Coherent<T> where
T: KnownSize + AsBytes + ?Sized. The function body only uses as_ptr()
and size(), which work for any such T, so there is no reason to
restrict it to byte slices.

Acked-by: Miguel Ojeda <ojeda@kernel.org>
Acked-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260325003921.3420-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 21:48:09 +01:00
Joshua Daley
0019a3a575 scsi: virtio_scsi: Kick event_list unconditionally
The event_list processes non-hotplug events (such as LUN capacity
changes), so remove the conditions that guard the initial kicks in
_probe() and _restore(), as well as the work cancellation in _remove().

Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://patch.msgid.link/20260325180857.3675854-3-jdaley@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:42:08 -04:00
Joshua Daley
da3159a3b3 scsi: virtio_scsi: Move INIT_WORK calls to virtscsi_probe()
The last step of virtscsi_handle_event() is to call
virtscsi_kick_event(), which calls INIT_WORK on its own work
item. INIT_WORK resets the work item's data bits to 0.

If this occurs while the work item is being flushed by
cancel_work_sync(), then kernel/workqueue.c/work_offqd_enable triggers a
kernel warning, as it expects the "disable" bit to be 1:

[   21.450115] workqueue: work disable count underflowed
[   21.450117] WARNING: CPU: 1 PID: 56 at kernel/workqueue.c:4328 enable_work+0x10a/0x120
...
[   21.450171] Call Trace:
[   21.450173]  [<000003db2e5bdc3e>] enable_work+0x10e/0x120
[   21.450176] ([<000003db2e5bdc3a>] enable_work+0x10a/0x120)
[   21.450178]  [<000003db2e5bdd86>] cancel_work_sync+0x86/0xa0
[   21.450181]  [<000003daae97d9e4>] virtscsi_remove+0xb4/0xd0 [virtio_scsi]
[   21.450184]  [<000003db2ef3b5ca>] virtio_dev_remove+0x6a/0xd0
[   21.450186]  [<000003db2ef9106c>] device_release_driver_internal+0x1ac/0x260
[   21.450190]  [<000003db2ef8edc8>] bus_remove_device+0xf8/0x190
[   21.450192]  [<000003db2ef88d72>] device_del+0x142/0x340
[   21.450194]  [<000003db2ef88fa0>] device_unregister+0x30/0xa0
[   21.450196]  [<000003db2ef3b2fa>] unregister_virtio_device+0x2a/0x40

This warning may occur if a controller is detached immediately following
a disk detach.

Move the INIT_WORK call to prevent this. Don't re-init event list work
items in virtscsi_kick_event(), init them only once in virtscsi_probe()
instead.

Signed-off-by: Joshua Daley <jdaley@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Link: https://patch.msgid.link/20260325180857.3675854-2-jdaley@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:42:08 -04:00
Asahi Lina
80df573af9 rust: drm: gem: shmem: Add DRM shmem helper abstraction
The DRM shmem helper includes common code useful for drivers which
allocate GEM objects as anonymous shmem. Add a Rust abstraction for
this. Drivers can choose the raw GEM implementation or the shmem layer,
depending on their needs.

Signed-off-by: Asahi Lina <lina@asahilina.net>
Signed-off-by: Daniel Almeida <daniel.almeida@collabora.com>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Janne Grunau <j@jananu.net>
Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Link: https://patch.msgid.link/20260316211646.650074-6-lyude@redhat.com
[ * DRM_GEM_SHMEM_HELPER is a tristate; when a module driver selects it,
    it becomes =m. The Rust kernel crate and its C helpers are always
    built into vmlinux and can't reference symbols from a module,
    causing link errors.

    Thus, add RUST_DRM_GEM_SHMEM_HELPER bool Kconfig that selects
    DRM_GEM_SHMEM_HELPER, forcing it built-in when Rust drivers need it;
    use cfg(CONFIG_RUST_DRM_GEM_SHMEM_HELPER) for the shmem module.

  * Add cfg_attr(not(CONFIG_RUST_DRM_GEM_SHMEM_HELPER), expect(unused))
    on pub(crate) use impl_aref_for_gem_obj and BaseObjectPrivate, so
    that unused warnings are suppressed when shmem is not enabled.

  * Enable const_refs_to_static (stabilized in 1.83) to prevent build
    errors with older compilers.

  * Use &raw const for bindings::drm_gem_shmem_vm_ops and add
    #[allow(unused_unsafe, reason = "Safe since Rust 1.82.0")].

  * Fix incorrect C Header path and minor spelling and formatting
    issues.

  * Drop shmem::Object::sg_table() as the current implementation is
    unsound.

    - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 21:38:40 +01:00
Lyude Paul
89b4964c04 rust: drm: gem: Add raw_dma_resv() function
For retrieving a pointer to the struct dma_resv for a given GEM object. We
also introduce it in a new trait, BaseObjectPrivate, which we automatically
implement for all gem objects and don't expose to users outside of the
crate.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Janne Grunau <j@jananu.net>
Tested-by: Janne Grunau <j@jannau.net>
Tested-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Link: https://patch.msgid.link/20260316211646.650074-3-lyude@redhat.com
[ Fix incorrect reference in safety comment. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 21:37:45 +01:00
Eric Biggers
e5046823f8 lib/crypto: chacha: Zeroize permuted_state before it leaves scope
Since the ChaCha permutation is invertible, the local variable
'permuted_state' is sufficient to compute the original 'state', and thus
the key, even after the permutation has been done.

While the kernel is quite inconsistent about zeroizing secrets on the
stack (and some prominent userspace crypto libraries don't bother at all
since it's not guaranteed to work anyway), the kernel does try to do it
as a best practice, especially in cases involving the RNG.

Thus, explicitly zeroize 'permuted_state' before it goes out of scope.

Fixes: c08d0e6473 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-03-27 13:35:35 -07:00
Dave Marquardt
a08d2e05a4 scsi: fc: Fix typo in fc_els.h
Fixed spelling error in fe_els.h. Change "caause" to "cause".

Signed-off-by: Dave Marquardt <davemarq@linux.ibm.com>
Link: https://patch.msgid.link/20260324-fix-typo-v1-1-601f4fde35bc@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:35:04 -04:00
Kees Cook
665fb6a643 scsi: target: Replace strncpy() with strscpy() in VPD dump functions
Replace the deprecated[1] strncpy() with strscpy() in
transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(),
transport_dump_vpd_ident_type(), and transport_dump_vpd_ident().

All four functions follow the same pattern: a local
buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated
via sprintf()/snprintf() (always NUL-terminated), then conditionally
copied to p_buf with strncpy(). The p_buf destination is used as a
C string by all callers in target_core_configfs.c: strlen(buf) and
sprintf(page+len, "%s", buf) to build sysfs output.

NUL-padding is not required: callers in target_core_configfs.c
pre-zero p_buf with memset() or initializer before calling these
functions, and consume p_buf only as a NUL-terminated C string via
strlen() and "%s", never exposing trailing bytes.

No behavioral change: the source buf is always NUL-terminated and
shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output.

Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://patch.msgid.link/20260323171311.work.101-kees@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:32:44 -04:00
Linus Torvalds
7df48e3631 RDMA v7.0 second rc
- Quite a few irdma bug fixes, several user triggerable
 
 - Fix a 0 SMAC header in ionic
 
 - Tolerate FW errors for RAAS in bng_re
 
 - Don't UAF in efa when printing error events
 
 - Better handle pool exhaustion in the new bvec paths
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCacaBOwAKCRCFwuHvBreF
 YYMHAQDA5ZP5E0Ry1ezgZl3RuIUXKdKI6Vgjkz0C5RM7kMvBRgD8CR00Kv80wCwY
 Ilug4IvLcRWCQwfBPdGlADdCC3OakwA=
 =uJTO
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

 - Quite a few irdma bug fixes, several user triggerable

 - Fix a 0 SMAC header in ionic

 - Tolerate FW errors for RAAS in bng_re

 - Don't UAF in efa when printing error events

 - Better handle pool exhaustion in the new bvec paths

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/irdma: Harden depth calculation functions
  RDMA/irdma: Return EINVAL for invalid arp index error
  RDMA/irdma: Fix deadlock during netdev reset with active connections
  RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
  RDMA/irdma: Clean up unnecessary dereference of event->cm_node
  RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
  RDMA/irdma: Update ibqp state to error if QP is already in error state
  RDMA/irdma: Initialize free_qp completion before using it
  RDMA/efa: Fix possible deadlock
  RDMA/rw: Fix MR pool exhaustion in bvec RDMA READ path
  RDMA/rw: Fall back to direct SGE on MR pool exhaustion
  RDMA/efa: Fix use of completion ctx after free
  RDMA/bng_re: Fix silent failure in HWRM version query
  RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()
  RDMA/irdma: Fix double free related to rereg_user_mr
2026-03-27 13:30:04 -07:00
Arnd Bergmann
6755741890 scsi: esas2r: Fix __printf annotation on esas2r_log_master()
clang-22 started warning about functions that take printf format
strings:

drivers/scsi/esas2r/esas2r_log.c:160:50: error: diagnostic behavior may be improved by adding the 'format(printf, 3, 0)' attribute to the declaration of 'esas2r_log_master' [-Werror,-Wmissing-format-attribute]
  121 |                 retval = vsnprintf(buffer, buflen, format, args);
      |                                                                ^
drivers/scsi/esas2r/esas2r_log.c:121:12: note: 'esas2r_log_master' declared here
  121 | static int esas2r_log_master(const long level,
      |            ^

The warning already got silenced for gcc but not clang in the past.
Rather than modify that hack to turn it off for both, just add the
attribute as suggested and remove the pragma again.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260323100027.1975646-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:29:50 -04:00
Andy Shevchenko
8ad1ddc50d scsi: ufs: rockchip: Drop unused include
This driver includes the legacy header <linux/gpio.h> but does not use
any symbols from it. Drop the inclusion.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/20260320215606.3236516-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-03-27 16:26:57 -04:00
Linus Torvalds
8af4fad545 pci-v7.0-fixes-5
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmnGkjwUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vxjGg/+JmSuiPpi809DKbyBxilKxLCxnKOt
 rlFwTNz9APzdDA2pBjzq1SXLllMb/SDbQeP5/gyg4pT6z5wIMOssHRMPa8RAluBR
 QvPdwaIWl/Y+iHQg20qr4cmqGXy0IqGTd1uLJRWxpA5ThLeB99C5ScS+AaWQhIZv
 hPZBztrXoAMFhLBr3M5slMy8w2nv/H9HGWL4gruVh5dymcQv4YJT3B3f9EZCYJS7
 TNgnUGRr+Bq6EgAAqeicIfJQDK2vVC8Cs05SbyFoTca8gVb1/7zAMR4oHTUbQb41
 lQ8t2tEKrsVjttcrVb8Y8QL2pGMPqSw2pdmEZldW1ByVCU37Fxb30g6hEuCVdQrd
 V/zhGTSiGGT6COHo7pv4AOrMyXBiYYcn7UZwvy4GDpck6Wf2NFKLFErUTSfURZ6I
 mKD18mDeK37hjKCbHfM3+pX4zoIAK5aPDWXweT+p5caglcPTj1YssQegklby2blt
 8lQiVQNdMSN4qKUpgnDFPp9E16zTgMmLDnUXOTnW5tsgtu7OqeEvMZYfv3jI/5Ag
 QkBlBadbuPl8RD4HwXg5Nqy+/q/H93GSy67OJbg3Sjc5STMpMOvOTXvI8R5JzzZu
 b36/hc57+ps9tk4fzYHw71FqlNi14KU93/H8NURIBQYFIXb2Lv9Y71j2WcLx97dE
 AtGThYTV8KcKwAg=
 =wlly
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.0-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fixes from Bjorn Helgaas:

 - Remove power-off from pwrctrl drivers since this is now done directly
   by the PCI controller drivers (Chen-Yu Tsai)

 - Fix pwrctrl device node leak (Felix Gu)

 - Document a TLP header decoder for AER log messages (Lukas Wunner)

* tag 'pci-v7.0-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  Documentation: PCI: Document PCIe TLP Header decoder for AER messages
  PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak
  PCI/pwrctrl: Do not power off on pwrctrl device removal
2026-03-27 13:25:58 -07:00
Linus Torvalds
83ce1c753f sound fixes for 7.0-rc6
This became a slightly big PR partly due to my time off in the last
 week.  But all changes are about device-specific fixes, so it should
 be safely applicable.
 
 * ASoC:
 - Fix double free in sma1307
 - Fix uninitialized variables in simple-card-utils/imx-card
 - Address clock leaks and error propagation in ADAU1372
 - Add DMI quirks and ACP/SDW support for ASUS
 - Fix Intel CATPT DMA mask
 - Fix SOF topology parsing
 - Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x
 
 * HD-audio:
 - Quirks for Lenovo, ASUS, and various HP models, as well as speaker
   pop fix on Star Labs StarFighter.
 - Revert MSI X870E Tomahawk denylist again.
 
 * USB-Audio:
 - Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen
 - Add iface reset quirk for AB17X
 - Update Qualcomm USB audio Kconfig dependencies and license
 
 * Misc:
 - Fix minor compile warnings for firewire and asihpi drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmnGWu8OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE8Ngw//bx14FvGyRaEaUAmN0Q5KrJXx6qQNukzwgz8P
 +ShG9fDFDXThybOxVcaO0US2mEadMXrcI1A7gfqAIuTTP/WAs5gj4WqzerlMA/Ea
 PRLgF22cevb7AaEbECtho23QP1+Zn4Z6p77qAc7/4gPr/B4WZDrTXYVva+Uhiovv
 QO6vAzqeTgaOJOlGHTSVKbYxWfbG8xQHrBARcHj0TbBhHNkw4jYAy7ZBGBcB/SG7
 QgdmOTkRHNdP6XMKv0gL+XuN1dmZtKBCgzGULaJR28LylgB5dRSaTE3xQ+kuIsLm
 tBoaL1hYtYzSHy0jubJ3OhW7CdCXcm+m9i52a7mlpZScQJpj70eCX9wbTcZdePS1
 LiKnMSGfNPkpYOR1kGC78ab+W1nO21K0HAH8KGrzB8Ok1nvM3gw2MziQAQFOz0d1
 hNtSIeAehnjVoRFpTAN5n5pJExoV/ok5OiwrEnlvK7JJvA/d0tTZAllB7y8gYdCX
 PEMjatbFCi6fOxGAmQI7k/0Sogj+iRcKqWjk5J/x712e6jT9Wl+eLWmZNsob4i5F
 zhCO0P4PSUAqjMg0p2iSzF5fKB9m9LPG2P3mvM+Vpgokb8txwnerW9amaBfrWIzy
 TqsYjMrN0xHlMJb50pjCIV9DyFHqFqyE8c8XknsIinzlfzB0n7voZgEp0Kkekxhc
 32SflSY=
 =Yks2
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "This became slightly big partly due to my time off in the last week.
  But all changes are about device-specific fixes, so it should be
  safely applicable.

  ASoC:
   - Fix double free in sma1307
   - Fix uninitialized variables in simple-card-utils/imx-card
   - Address clock leaks and error propagation in ADAU1372
   - Add DMI quirks and ACP/SDW support for ASUS
   - Fix Intel CATPT DMA mask
   - Fix SOF topology parsing
   - Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x

  HD-audio:
   - Quirks for Lenovo, ASUS, and various HP models, as well as
     a speaker pop fix on Star Labs StarFighter
   - Revert MSI X870E Tomahawk denylist again

  USB-Audio:
   - Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen
   - Add iface reset quirk for AB17X
   - Update Qualcomm USB audio Kconfig dependencies and license

  Misc:
   - Fix minor compile warnings for firewire and asihpi drivers"

* tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits)
  Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist"
  ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio
  ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
  ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP
  ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
  ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform
  ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
  ASoC: adau1372: Fix clock leak on PLL lock failure
  ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
  ASoC: SDCA: fix finding wrong entity
  ASoC: SDCA: remove the max count of initialization table
  ASoC: codecs: wcd934x: fix typo in dt parsing
  ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match
  ASoC: Intel: catpt: Fix the device initialization
  ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine
  ASoC: SOF: topology: reject invalid vendor array size in token parser
  ASoC: tas2781: Add null check for calibration data
  ALSA: asihpi: avoid write overflow check warning
  ASoC: fsl: imx-card: initialize playback_only and capture_only
  ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only
  ...
2026-03-27 13:16:40 -07:00
Linus Torvalds
f44c65111e [GIT PULL for v7.0-rc6] media fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmnGRUMACgkQCF8+vY7k
 4RVnhg/9EuN2Lz9XFm86e/b2/gQowj/cVise8SLFQsXQoBQtNWc5qJyQIJaXGATs
 mSONFX+rtRZHZrlxg3YD27oFuvYWOQ3aVJHJv4SZsbejfK11kLOk3RDpJ267DyCC
 i8Q8ymvC20lGD7Wu8zaOGttULobkfIfgL3PPhob3aQAdv73zRoBHlalfHFuVrrBB
 mnDGyRx07GsuzCsJO9KBEdBZqTBKRifzpQuBNJy7nk2LP+G85Bd0gFPcRoFgQ4n9
 /QgmD08GOQhXtqqDn6gN0YnMejKxqB52TFz4nsMg3RwaLJxWsTGnnXur8jm0sPZg
 /684R8Q8S+e+huniu8R3p0OjpEqAboWDknJCrOuPreWxeZIcbdNx1D6aSumv7D29
 nRvKaWperzvziR3PK0QnXr0XDCNdoiFA3BM0eTAnpRfvROzkOn+EvXNC9R/7B8gJ
 vam7dk3qoc1jxQ05WDTE0r1XGa8up9gQzMdBtSMYmTKmm1GRa2mZhiTaE6G44ue/
 F5FjlSZf7g92gOBrvt3hcO17Rve9JaAf4P2yI2LimtZLWtIVCeLfAt/MXk3Nr0d1
 LKcobTOLGzZA2GNvCNcCTPwrrtXcuxcCvr5cvLpNPYe+3DCiDxUp9l8OylGnSr88
 T/XA2kS6GFHnNqzTPGFoxnQBw4QfCQ82wqDBOLLLOW0MulrjU3Y=
 =nrey
 -----END PGP SIGNATURE-----

Merge tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - uvcvideo may cause OOPS when out of memory

 - remove a deadlock in the ccs driver

* tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: ccs: Avoid deadlock in ccs_init_state()
  media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers
2026-03-27 13:10:49 -07:00
Linus Torvalds
0b8bf3b64e Summary
* Fix uninitialized variable error when writing to a sysctl bitmap
 
   Removed the possibility of returning an unjustified -EINVAL when writing to a
   sysctl bitmap
 
 * Testing
 
   Quickly passed through linux-next.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmnE85UACgkQupfNUreW
 QU+XkQv/YqEcAQYGYHX0OEvjjTtmQwGDOyD+EkwztCfaW+9lL4XxPKG13kH0kaTI
 4u+R2E2/pQCFmY4ln85Rl8nhgLtKavyrRBr5U7ml68tC0MGYSFP7soDQWHIBd+u3
 RxGMvOBpEH8MUpR1QxFuc4TYlm/VR05sojK/rf2xDf2RmW45ZRpGsKleWNJa8tl2
 fq0kYA3tMy68QZ49NIsn9tbhYso1TQa/oGh+ocYuvUOYA7fbsXQ8Nl227Jk0WQY4
 krtB0CPxyzKLDjyDZ7LJAbpE8xg0b5oRzpBSLmMoRaxrdbkhznlDcYzZNROIUoJe
 ktQ23ZtI+rRJc5bdnRZcrrXIrxEFjYfCVou52I4xUSs6zi4QpuOUUMySkDqyIshV
 lecvMDMYExpi1lLufZWSCRn0LWPWGVqJPSkUEPMynIkaZgdAh4CKgpEVItNtGkip
 4P2tJz8nlRlFr2IINJWJCCdgt0p1h3a1jb41lSznNp2FFvf8d7jDhjZWEl0tMf8u
 l81ivZ4n
 =qCgc
 -----END PGP SIGNATURE-----

Merge tag 'sysctl-7.00-fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

Pull sysctl fix from Joel Granados:
 "Fix uninitialized variable error when writing to a sysctl bitmap

  Removed the possibility of returning an unjustified -EINVAL when
  writing to a sysctl bitmap"

* tag 'sysctl-7.00-fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: fix uninitialized variable in proc_do_large_bitmap
2026-03-27 13:04:34 -07:00
Asahi Lina
9b836641d3 rust: helpers: Add bindings/wrappers for dma_resv_lock
This is just for basic usage in the DRM shmem abstractions for implied
locking, not intended as a full DMA Reservation abstraction yet.

Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Asahi Lina <lina+kernel@asahilina.net>
Signed-off-by: Daniel Almeida <daniel.almeida@collabora.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Janne Grunau <j@jannau.net>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Acked-by: David Airlie <airlied@gmail.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260320-gpuvm-rust-v5-2-76fd44f17a87@google.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-27 20:46:56 +01:00
Linus Torvalds
3577cfd738 xfs: fixes for 7.0-rc6
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCacY+kQAKCRBcsMJ8RxYu
 Y6bMAXwL00+ri1ygA5s3PCaY965nLOchGrWjy0nCS075NTgYGo4Jq/hXBDDJPdRy
 bg1cr6sBf2u5Qx2jQ3wrTy63XbHQ78wM+0lNZCMAobSpPC7li+wAIQ8l8wNGitU8
 WQdkTBSfCw==
 =nciv
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:
 "This includes a few important bug fixes, and some code refactoring
  that was necessary for one of the fixes"

* tag 'xfs-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: remove file_path tracepoint data
  xfs: don't irele after failing to iget in xfs_attri_recover_work
  xfs: remove redundant validation in xlog_recover_attri_commit_pass2
  xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
  xfs: close crash window in attr dabtree inactivation
  xfs: factor out xfs_attr3_leaf_init
  xfs: factor out xfs_attr3_node_entry_remove
  xfs: only assert new size for datafork during truncate extents
  xfs: annotate struct xfs_attr_list_context with __counted_by_ptr
  xfs: cleanup buftarg handling in XFS_IOC_VERIFY_MEDIA
  xfs: scrub: unlock dquot before early return in quota scrub
  xfs: refactor xfsaild_push loop into helper
  xfs: save ailp before dropping the AIL lock in push callbacks
  xfs: avoid dereferencing log items after push callbacks
  xfs: stop reclaim before pushing AIL during unmount
2026-03-27 12:22:45 -07:00
Luo Haiyang
1f98857322 tracing: Fix potential deadlock in cpu hotplug with osnoise
The following sequence may leads deadlock in cpu hotplug:

    task1        task2        task3
    -----        -----        -----

 mutex_lock(&interface_lock)

            [CPU GOING OFFLINE]

            cpus_write_lock();
            osnoise_cpu_die();
              kthread_stop(task3);
                wait_for_completion();

                      osnoise_sleep();
                        mutex_lock(&interface_lock);

 cpus_read_lock();

 [DEAD LOCK]

Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock).

Cc: stable@vger.kernel.org
Cc: <mathieu.desnoyers@efficios.com>
Cc: <zhang.run@zte.com.cn>
Cc: <yang.tao172@zte.com.cn>
Cc: <ran.xiaokai@zte.com.cn>
Fixes: bce29ac9ce ("trace: Add osnoise tracer")
Link: https://patch.msgid.link/20260326141953414bVSj33dAYktqp9Oiyizq8@zte.com.cn
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Luo Haiyang <luo.haiyang@zte.com.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-03-27 15:18:06 -04:00
Sachin Mokashi
ebbe5d957e
ASoC: Intel: ehl_rt5660: remove unused macro definitions
DUAL_CHANNEL and NAME_SIZE macros are not being used (anymore) but the
macros are still defined. Remove them to clean up dead code.

Signed-off-by: Sachin Mokashi <sachin.mokashi@intel.com>
Link: https://patch.msgid.link/20260324163400.1276247-1-sachin.mokashi@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 19:13:56 +00:00
Shuming Fan
ae00200acb
ASoC: SDCA: fix the register to ctl value conversion for Q7.8 format
The division calculation should be implemented using signed integer format.
This patch changes mc->shift from an unsigned type to a signed integer during the calculation.

Fixes: 501efdcb3b ("ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops")
Signed-off-by: Shuming Fan <shumingf@realtek.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260327082331.2277498-1-shumingf@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 19:12:33 +00:00
Linus Torvalds
34892992d0 five server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmnF6AEACgkQiiy9cAdy
 T1GydAv/cQNJiOJM6CVyAcuixCqf8bxmLkjYqGhPQ7jcjYjY688UJ4l5LCwKkWj8
 7mlhHO2Ly0trlUn6dBet/0zVctQ8T0caMrOaht9BLnscdOHXdS3Sn27EZ02Ba8zF
 aS3XYa792PASIeUf9CEvztaEMYW9BkJ8hQt4Z1qdgYIWgvIEeDiAgR+4tmB0iAaO
 UbAU/bqSLzTC80wukUTa41ofJTEdb7Sg147BbP2p+D8aKBKxaQWEz71RS+erjlmQ
 bx0AdImfdLkDWyEnFP7raGmNH/XOx76uDBVamKZEiTLz/MlRJRtXNFUwXeH+SH6p
 92vatbkUbDHmMxCx0xhhFFci6oGSl1sS2R9jWxLgVHnup+apWyt6XcSXQq7yFt80
 +C2EJiIlNpddWg9jEL3Q+Z/r3lN66cIztyuhN+Xuzo0zLMX80kfFhtW4KyJ24Gdj
 sJCury5fcDqs264MMlO+q6r7nefViJaEWclfu1uvUjXwdybpofkM4i4Ki7106wsN
 XQm/umrf
 =41HQ
 -----END PGP SIGNATURE-----

Merge tag 'v7.0-rc5-ksmbd-srv-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix out of bounds write

 - Fix for better calculating max output buffers

 - Fix memory leaks in SMB2/SMB3 lock

 - Fix use after free

 - Multichannel fix

* tag 'v7.0-rc5-ksmbd-srv-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix potencial OOB in get_file_all_info() for compound requests
  ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
  ksmbd: fix memory leaks and NULL deref in smb2_lock()
  ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
  ksmbd: do not expire session on binding failure
2026-03-27 12:03:39 -07:00
Ethan Tidmore
553a127cb6 iommu/riscv: Fix signedness bug
The function platform_irq_count() returns negative error codes and
iommu->irqs_count is an unsigned integer, so the check
(iommu->irqs_count <= 0) is always impossible.

Make the return value of platform_irq_count() be assigned to ret, check
for error, and then assign iommu->irqs_count to ret.

Detected by Smatch:
drivers/iommu/riscv/iommu-platform.c:119 riscv_iommu_platform_probe() warn:
'iommu->irqs_count' unsigned <= 0

Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Fixes: 5c0ebbd3c6 ("iommu/riscv: Add RISC-V IOMMU platform device driver")
Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 19:55:52 +01:00
Gregory Price
29990ab5cb cxl/core: use cleanup.h for devm_cxl_add_dax_region
Cleanup the gotos in the function.  No functional change.

Signed-off-by: Gregory Price <gourry@gourry.net>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260327020203.876122-4-gourry@gourry.net
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-27 11:45:39 -07:00
Gregory Price
d747cf98f0 cxl/core/region: move dax region device logic into region_dax.c
core/region.c is overloaded with per-region control logic (pmem, dax,
sysram, etc). Move the CXL DAX region device infrastructure from
region.c into a new region_dax.c file.

This will also allow us to add additional dax-driver integration paths
that don't further dirty the core region.c logic.

No functional changes.

Signed-off-by: Gregory Price <gourry@gourry.net>
Co-developed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260327020203.876122-3-gourry@gourry.net
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-27 11:45:31 -07:00
Gregory Price
8a1ec5fb23 cxl/core/region: move pmem region driver logic into region_pmem.c
core/region.c is overloaded with per-region control logic (pmem, dax,
sysram, etc). Move the pmem region driver logic from region.c into
region_pmem.c make it clear that this code only applies to pmem regions.

No functional changes.

[ dj: Fixed up some tabbing issues, may be from original code. ]

Signed-off-by: Gregory Price <gourry@gourry.net>
Co-developed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260327020203.876122-2-gourry@gourry.net
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-27 11:45:21 -07:00
Kuninori Morimoto
7caae0aed0
ASoC: soc-core: remove unused dobj_list
commit 8a9782346d ("ASoC: topology: Add topology core")
added dobj_list to Component and Card, but Card side has
never been used. Remove it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/874im2xa98.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 18:38:44 +00:00
Mark Brown
9800e7741f
ASoC: Drop some unused GPIO includes
Linus Walleij <linusw@kernel.org> says:

This drops the unnecessary legacy includes from three
more codecs.

Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-0-9fcecf868fda@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 18:37:57 +00:00
Linus Walleij
00e981c7c0
ASoC: ts3a227e: Drop unused include
The driver includes the legacy GPIO header <linux/gpio.h> but does
not use any symbols from it so drop the include.

Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-3-9fcecf868fda@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 18:37:55 +00:00
Linus Walleij
175b2d0258
ASoC: nau8315: Drop unused include
The driver includes the legacy GPIO header <linux/gpio.h> but does
not use any symbols from it so drop the include. (It is already
using the consumer header as is proper.)

Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-2-9fcecf868fda@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 18:37:54 +00:00
Linus Walleij
486c064515
ASoC: rt1318: Drop unused include
The driver includes the legacy GPIO header <linux/gpio.h> but does
not use any symbols from it so drop the include.

Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-1-9fcecf868fda@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-27 18:37:54 +00:00
Cheng-Yang Chou
238aa43f0b sched_ext: Document why built-in DSQs are unsupported sources in scx_bpf_dsq_move_to_local()
Add a comment explaining the design intent behind rejecting built-in DSQs
(%SCX_DSQ_GLOBAL and %SCX_DSQ_LOCAL*) as sources. Local DSQs support
reenqueueing but the BPF scheduler cannot directly iterate or move tasks
from them. %SCX_DSQ_GLOBAL is similar but also doesn't support
reenqueueing because it maps to multiple per-node DSQs, making the scope
difficult to define.

Also annotate @dsq_id to make clear it must be a user-created DSQ.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-27 07:33:08 -10:00
Zhao Mengmeng
d6edb15ad9 scx_central: Defer timer start to central dispatch to fix init error
scx_central currently assumes that ops.init() runs on the selected
central CPU and aborts otherwise. This is no longer true, as ops.init()
is invoked from the scx_enable_helper thread, which can run on any
CPU.

As a result, sched_setaffinity() from userspace doesn't work, causing
scx_central to fail when loading with:

[ 1985.319942] sched_ext: central: scx_central.bpf.c:314: init from non-central CPU
[ 1985.320317]    scx_exit+0xa3/0xd0
[ 1985.320535]    scx_bpf_error_bstr+0xbd/0x220
[ 1985.320840]    bpf_prog_3a445a8163fa8149_central_init+0x103/0x1ba
[ 1985.321073]    bpf__sched_ext_ops_init+0x40/0xa8
[ 1985.321286]    scx_root_enable_workfn+0x507/0x1650
[ 1985.321461]    kthread_worker_fn+0x260/0x940
[ 1985.321745]    kthread+0x303/0x3e0
[ 1985.321901]    ret_from_fork+0x589/0x7d0
[ 1985.322065]    ret_from_fork_asm+0x1a/0x30

DEBUG DUMP
===================================================================

central: root
scx_enable_help[134] triggered exit kind 1025:
  scx_bpf_error (scx_central.bpf.c:314: init from non-central CPU)

Fix this by:
- Defer bpf_timer_start() to the first dispatch on the central CPU.
- Initialize the BPF timer in central_init() and kick the central CPU
to guarantee entering the dispatch path on the central CPU immediately.
- Remove the unnecessary sched_setaffinity() call in userspace.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-27 07:33:00 -10:00
Yeoreum Yun
e223258ed8 arm64: armv8_deprecated: Disable swp emulation when FEAT_LSUI present
The purpose of supporting LSUI is to eliminate PAN toggling. CPUs that
support LSUI are unlikely to support a 32-bit runtime. Rather than
emulating the SWP instruction using LSUI instructions in order to remove
PAN toggling, simply disable SWP emulation.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
[catalin.marinas@arm.com: some tweaks to the in-code comment]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-27 17:29:10 +00:00